cvs: phpweb / downloads.php index.php release_4_1_2_win32.php

imajes Tue Mar 12 06:39:27 2002 EDT Added files: /phpweb release_4_1_2_win32.php Modified files: /phpweb downloads.php index.php Log: finally, php 4.1.2 on windows! Index: phpweb/downloads.php diff -u phpweb/downloads.php:1.86 phpweb/downloads.php:1.87 --- phpweb/downloads.php:1.86 Sun Mar 10 11:52:01 2002 +++ phpweb/downloads.php Tue Mar 12 06:39:26 2002 @@ -66,11 +66,11 @@ <h2>Windows Binaries</h2> All Windows binaries can be used on Windows 95/98/Me and on Windows NT/2000/XP. <ul> - <li><?php download_link("php-4.1.1-Win32.zip", "PHP 4.1.1 zip package"); ?> - 03 January 2002<br> - (CGI binary plus server API versions for Apache, AOLserver, ISAPI and NSAPI. MySQL + <li><?php download_link("php-4.1.2-Win32.zip", "PHP 4.1.2 zip package"); ?> - 12 March 2002<br> + (CGI binary (with security fixes) plus server API versions for Apache, AOLserver, ISAPI and NSAPI. MySQL support built-in, many extensions included, packaged as zip)</li> - <li><?php download_link("php-4.1.1-installer.exe", "PHP 4.1.1 installer"); ?> - 03 January 2002<br> - (CGI only, MySQL support built-in, packaged as Windows installer to install and + <li><?php download_link("php-4.1.2-installer.exe", "PHP 4.1.2 installer"); ?> - 12 March 2002<br> + (CGI only (with fixes), MySQL support built-in, packaged as Windows installer to install and configure PHP, and automatically configure IIS, PWS and Xitami, with manual configuration for other servers. N.B. no external extensions included)</li> <!-- Index: phpweb/index.php diff -u phpweb/index.php:1.203 phpweb/index.php:1.204 --- phpweb/index.php:1.203 Tue Mar 5 18:56:59 2002 +++ phpweb/index.php Tue Mar 12 06:39:27 2002 @@ -77,6 +77,18 @@ echo "\n<!--$MYSITE-->\n"; ?> + +<h1>PHP Security Update - Windows Version</h1> +<p> +<font class="newsDate">[12-Mar-2002]</font> +Following up from the previous annoucement, PHP 4.1.2 has been released for windows. The delayed release is due to +the fix of a further security issue only relating to the PHP for Windows version. More information on this change can +be found <?php print_link('/release_4_1_2_win32.php', 'here'); ?>. All PHP - Windows users are encouraged to upgrade to +the <?php print_link('/downloads.php', 'latest version'); ?>. +</p> + +<?php echo hdelim(); ?> + <h1>PHP Security Update</h1> <p> <font class="newsDate">[27-Feb-2002]</font> Index: phpweb/release_4_1_2_win32.php +++ phpweb/release_4_1_2_win32.php <?php require_once 'prepend.inc'; commonHeader("Hypertext Preprocessor"); ?> <h1> PHP 4.1.2 Windows (Win32) Release Announcement </h1> <p> Due to an issue with the Windows binary allowing any user to read or execute the contents of a file directly from the PHP binary, we have delayed the 4.1.2 release of PHP for Windows to allow for this fix. This release also fixes the file upload security problem.</p> <p>With this new release, we introduce 2 new php.ini settings, which MUST be set to make the binary work. It's worth noting, at this point, that this particular fix only applies to the CGI binary. The SAPI module will still work as expected, and it's use is encouraged.</p> <p> The new settings are: <ul> <li>cgi.force_redirect 0|1</li> <li>cgi.redirect_status_env ENV_VAR_NAME</li> </ul> </p> <h2>WebServers affected by this vulnerability</h2> <p> It is known that Apache (any version) and iPlanet servers are vulnerable to this issue, however Microsoft IIS is not. Since cgi.force_redirect takes a value of either 1 or 0, (on or off) you should set it to 1 if you are running Apache or iPlanet servers, and to 0 for IIS. If you are unsure of which you need, set it to 1 and see if your scripts execute. You will need to stop and restart your server when you change your php.ini file, for the changes to have effect. </p> <p> if cgi.force_redirect is turned on, and you are not running under Apache or Netscape (iPlanet) web servers, you MAY need to set an environment variable name that PHP will look for to know it is OK to continue execution. Setting this variable MAY cause security issues, so check what you are doing first. </p> <p> More information can be found <a href="http://security.e-matters.de/advisories/012002.html">here</a> relating to the form upload exploit that caused the release of 4.1.2 initially. </p> <?php commonFooter(); ?>